City of London Police Reprimanded for Data Protection Failures

ICO Enforcement

Filed February 20th, 2026

Detected March 18th, 2026

Summary

The UK's Information Commissioner's Office (ICO) has issued a reprimand to the Commissioner of Police for the City of London for failing to respond to Subject Access Requests (SARs) within statutory timeframes. This action highlights data protection obligations for law enforcement agencies.

View original document View source feed page

What changed

The Information Commissioner's Office (ICO) has issued a formal reprimand to the Commissioner of Police for the City of London (COLP). The reprimand stems from COLP's failure to meet its data protection obligations concerning Subject Access Requests (SARs), specifically by not responding within the statutory timeframes between April 1, 2023, and July 31, 2025. This contravenes Article 12(3) of the UK GDPR and Section 45(3) of the Data Protection Act 2018.

This enforcement action serves as a significant warning to law enforcement agencies regarding their compliance with data protection laws, particularly the timely handling of SARs. While this is a reprimand and not a monetary penalty, it signifies a failure in data protection duties. The City of London Police must review and improve its internal processes for handling SARs to ensure compliance with UK GDPR and DPA 2018 requirements to avoid further regulatory action.

What to do next

Review internal processes for handling Subject Access Requests (SARs).
Ensure all SARs are responded to within the statutory timeframes stipulated by UK GDPR and DPA 2018.
Implement training for relevant staff on data protection obligations related to SARs.

Penalties

Reprimand issued.

Source document (simplified)

The Commissioner of Police for the City of London

Date 20 February 2026
Type Reprimands
Sector Criminal justice A reprimand has been issued to The Commissioner of Police for the City of London (COLP), after it failed to meet its data protection obligations in responding to SARs within the statutory timeframe during the period 1 April 2023 to 31 July 2025, thereby contravening Article 12(3) UK GDPR and s45(3) DPA 2018.